FDA Draft Guidance on Electronic Health Records in Clinical Investigations

Clinical trial sponsors should take note of FDA’s new draft guidance on the Use of Electronic Health Record Data in Clinical Investigations (May 2016) (Draft Guidance).  The Draft Guidance is replete with recommendations and best practices.  This article addresses the goals and scope of the Draft Guidance, provides key takeaways and recommendations, and concludes with observations.

The Draft Guidance builds on the Electronic Source Data in Clinical Investigations guidance (September 2013) (referred to by FDA as the “esource guidance”) that we wrote about here and the Computerized Systems Used in Clinical Investigations guidance (May 2007).


Goals and Scope

Use and Interoperability with EDCs.  The goals of the Draft Guidance are to encourage the use of electronic health record (EHR) data in clinical trials and to promote the interoperability between institution EHRs and sponsors’ “electronic systems supporting the clinical investigations,” such as electronic data capture (EDC) systems.  This will help modernize and streamline clinical trials.

Definition of EHRs.  The Draft Guidance defines EHRs as “electronic platforms that contain individual electronic health records for patients and are maintained by health care organizations and institutions.”  They typically include information such as patient medical history, diagnoses, radiology images, pharmacy records, and lab and test results.  Institutions often use EHRs to integrate real-time electronic health care information from medical devices and the patient’s other health care providers.  Industry and sites often use the term “EHR” to mean an individual patient’s electronic health record (as opposed to the entire electronic platform).  Please note that for purposes of this article and the Draft Guidance, “EHR” means the electronic platform or system that contains the electronic health records.

Advantages.  Potential benefits of EHRs in clinical investigations include improved patient safety, data accuracy and clinical trial efficiency.  Further, EHRs could enable investigators to more easily aggregate and analyze data from many sources, provide real-time and longitudinal data for review, and facilitate post-study long term follow up.

Covered Studies.  The Draft Guidance applies to prospective clinical trials, including foreign studies not conducted under IND or IDE that are submitted to FDA in support of a marketing application.  The Draft Guidance does not apply to postmarket observational pharmacoepidemiologic studies or to patient recruitment.


Key Takeaways with Recommendations in Bold

1. ALCOA is best practices for data integrity.

a. Sponsors should ensure that the institution EHRs provide electronic source data that is attributable, legible, contemporaneous, original and accurate (ALCOA).

b. ALCOA is not a new standard. FDA is increasingly emphasizing data integrity, particularly for electronic records.

c. The clinical trial agreement (CTA) between the sponsor and trial site should contain appropriate warranties and covenants by the trial site that its EHR meets the ALCOA standard.

2. Part 11:

a. FDA will not assess trial site EHRs for Part 11 compliance. This reiterates FDA’s position stated in the esource guidance.

b. FDA will assess Part 11 compliance on data from the EHR at the point when that data enter the EDC system (or other sponsor electronic system that supports the study).

3. Office of the National Coordinator (ONC) for Health IT Certification Program:

a. The Health Information Technology for Economic and Clinical Health (HITECH) Act requires ONC to establish a voluntary certification program for health IT. FDA encourages the use of ONC-certified EHRs, stating that use of an ONC-certified EHR would give FDA “confidence” during inspections that (i) the EHR data are reliable, and (ii) the technical and software components of privacy and security protection requirements have been met.

b. During due diligence of the trial site, the sponsor should investigate whether the site’s EHR is ONC-certified. If so, the sponsor should document this and include an appropriate certification in the CTA.

4. EHRs that are not ONC-certified can still be used: Lack of ONC certification does not doom the data.  However, sponsors should confirm that non-certified EHRs contain adequate controls to ensure data confidentiality, integrity and reliability.  During due diligence, the sponsor should investigate the following:

a. Does the EHR have the following internal safeguards?

i. Access is limited to authorized users;

ii. Authors of records are identifiable;

iii. Audit trails track changes to data; and

iv. Records are available and retained for FDA inspection for as long as the records are required by applicable regulations.

b. If the four criteria above are not met, the sponsor should assess the risks of using the EHR, including:

i. Potential harm to research subjects;

ii. Patient privacy rights; and

iii. Data integrity of the trial and its regulatory implications.

c. The sponsor should document the results of this investigation. If the EHR meets the criteria of Paragraph 4(a), the sponsor should consider adding appropriate warranties and covenants by the institution in the CTA.  

5. The sponsor’s protocol or data management plan: This should:

a. include information about the intended use of the EHR for the trial;

b. describe or diagram the flow of electronic data between the EHR and sponsor’s EDC system (particularly for EHRs that are interoperable with the EDC system, sponsor and the investigators should have a detailed understanding of the data flow and data visibility); and

c. describe how the EHR data are extracted and then imported into the EDC system.

6. Software and data fundamentals: The sponsor should confirm and ensure that:

a. software updates to both the EHR and EDC systems do not affect the reliability and integrity of the EHR data entering the EDC system;

b. archive and backup of EHR data that may be used for the study are retained for the regulatory record retention period “and are not lost” before the period expires (in a footnote, FDA explains that if the records are not available, FDA may not accept the study data in support of an IND);

c. modifications/corrections to EHR data (that may be used for the study) by non-study personnel will not obscure the previous entries, and sponsor’s EDC system will capture any updated information and accompanying audit trail information;

d. audit trails:

i. have adequate methods to monitor, track and document all changes to information in the EHR relating to the study; and

ii. will have the following available to FDA during inspection: identification of the data originator, and the date and time the data were entered into the EHR; and

e. EHR safeguards for privacy and security exist for both current subjects and subjects who leave the study early.

7. Informed consent:

a. The informed consent form (ICF) must (which means these are FDA requirements, not recommendations):

i. include a statement regarding the confidentiality of records identifying the subject (note, this is not news, but sponsors need to remember to address this in the EHR context); and

ii. identify all entities who may access the patient’s EHR relating to the study, including sponsors, CROs, study monitors, etc.

b. Sponsor should consider whether there are any “reasonably foreseeable risks” using EHRs that should be added to the ICF, such as a data breach.

c. Treatment of an EHR data breach as a “subject injury” is an accident waiting to happen for the unlucky sponsor whose subject injury clauses and CTA indemnification provisions inadvertently create a perfect storm. While we are not aware of litigation or damages payable by sponsors for subject injuries caused by EHR data breaches, if the subject injury language of the CTA and ICF does not narrowly cover bodily injury or injury caused by the study product, the sponsor may have to fend off (and pay for the defense costs of) subject data breach claims even if the sponsor is not ultimately at fault.  For example, a creative litigator could argue that “injury caused by participation in the study” includes EHR data breach (this ICF language is favored by many trial sites and can require a lot of negotiating to modify).  In this situation, rather than having to resort to theories of common law indemnification or contribution to be made whole, the sponsor would be better off ensuring that the CTA indemnification covers the sponsor in the event of EHR data breach.   The prudent sponsor will carefully review its ICF and CTA subject injury clauses and CTA indemnification provisions to determine its obligations to the subject and remedies from the site in the event of an EHR breach.

8. Source data verification:

a. Sponsors should:

i. check the data extracted from the EHR “for consistency and completeness with the source data obtained from the EHR;” and

ii. make sure that “data from the EHRs are consistent with the data collection specified in the clinical protocol.”

b. The CTA should ensure that study monitors have suitable access to all relevant subject information pertaining to the study, including source data in the EHR. Historically, sites have been hesitant about giving sponsors access to their electronic data systems for source data verification. This is changing. Many sites have implemented methods for monitors to access the electronic systems to conduct source data verification while ensuring privacy and security.

9. FDA access and data storage:  Consistent with regulations and prior guidance,

a. FDA must have access to records and may inspect and copy all records pertaining to the study. When the EHR is identified as the source, all relevant data within the EHR pertaining to the study must be made available to FDA for review upon request.

b. Investigators must retain all paper and electronic source documents and records as required to be maintained in compliance with 21 CFR 314 312.62(c) and 812.140(d), including EHRs pertaining to the study.

c. In the CTA, the definition of “Source Records” should include EHR data, if applicable. The CTA monitoring, access, inspection and data storage sections should address the EHR.



With this Draft Guidance, FDA offers additional encouragement for industry and research institutions to make their electronic systems interoperable and to self-regulate in the area of electronic data integrity.  However, the Draft Guidance seems to assume that one setup will apply to all trial sites in a multi-center study.  In practice, technology and data flow will vary from institution to institution, making it difficult for sponsors to adopt a one-size-fits-all approach to EHRs in their protocols or data management plans.

Last summer, FDA announced that it was seeking technology solutions to integrate the capture of data for EHRs and EDC systems. Specifically, FDA solicited demonstration projects to test end-to-end EHR to EDC single-point data capture.  The Draft Guidance does not refer to this project or its outcome.

Most companies know first-hand how hard it can be to make technologies talk to each other and to integrate legacy systems with new technology.  While interoperability between EHRs and EDC systems sounds great in theory, it is an undertaking that many sponsors will not jump at until their EDC vendors are routinely offering standardized solutions that integrate with the EHR technologies at the trial sites.  Whether the Draft Guidance is setting the stage for imminent new technologies that will effectively integrate EHRs with EDCs remains to be seen.

In a nutshell, the Draft Guidance’s impact on clinical trial sponsors will depend on each trial site’s EHR and the EHR’s relationship to the EDC system and study protocol.  Variables include, among other things, what types of study-related data are stored in the EHR, how the EHR communicates (if at all) with the EDC system, whether the EHR has a dedicated research module and whether the EHR is ONC-certified.

This Draft Guidance is another reminder for sponsors to involve experienced information technology (IT) personnel in the trial site due diligence phase.  Both clinical and IT personnel should carefully read the Draft Guidance in conjunction with the esource guidance.   These personnel need to understand what questions to ask about the sponsor’s systems and the sites’ EHRs in order to gain a clear understanding of the data flow (including data originator and source) and visibility and the relationship of the EHR to the EDC system.  The sponsor can then manage this through due diligence, the protocol, data management plan, clinical trial agreement and informed consent.   

Comments to the Draft Guidance are due by July 18, 2016.



If you have any questions or would like more information about these developing issues, please contact the following:

This contents of this alert should not be construed as legal advice or a legal opinion on any specific facts or circumstances. This content is not intended to and does not, by its receipt, create an attorney-client relationship. The contents are intended for general informational purposes only. We urge you to consult your attorney about the specific situation and any legal questions you may have. Attorney advertising in some jurisdictions. © 2024 Leibowitz Law. All rights reserved. “Leibowitz Law” is a trade name of Leibowitz LLC.

Want to receive notifications?

To be notified when we post new Insights, please sign up for our email list. As industry thought leaders, Leibowitz Law Insights address developing issues at the intersection of law, regulation, technology and life sciences…